PT-2025-53607 · Yt-Dlp+1 · Yt-Dlp+1

Pyroxenites · Published 2025-12-26 · Updated 2026-03-09 · CVE-2025-66203

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StreamVault versions prior to 251126

Description StreamVault is a video download integration solution. A Remote Code Execution (RCE) issue exists in the stream-vault application (SpiritApplication). The application does not properly validate administrator-configured yt-dlp arguments through the /admin/api/saveConfig API endpoint. These arguments are stored and later used in YtDlpUtil.java when constructing the command line for executing yt-dlp. This allows for potential command execution. The vulnerable parameter is ytdlpargs.

Recommendations Versions prior to 251126 should be updated to version 251126 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-66203

GHSA-C747-Q388-3V6M

Affected Products

Streamvault

Yt-Dlp

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66203.json · Exploit
• https://github.com/lemon8866/StreamVault/security/advisories/GHSA-c747-q388-3v6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66203 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66203 · Vendor Advisory
• https://github.com/lemon8866/StreamVault/releases/tag/251226 · Note
• https://t.me/CVEtracker/40732 · Telegram Post
• https://t.me/cveNotify/154781 · Telegram Post
• https://twitter.com/CVEnew/status/2004868111305163081 · Twitter Post
• https://twitter.com/cracbot/status/2006681849511424148 · Twitter Post
• https://twitter.com/0dayPublishing/status/2004702685925191683 · Twitter Post
• https://twitter.com/CveFindCom/status/2004713584081723617 · Twitter Post
• https://twitter.com/TheHackerWire/status/2004714759724347736 · Twitter Post
• https://twitter.com/offseq/status/2004704924404203595 · Twitter Post
• https://t.me/cveNotify/146923 · Telegram Post
• https://twitter.com/dailycve/status/2031040510253490228 · Twitter Post